Add /llm endpoint to flask-poc weblog (#7127)

Co-authored-by: Claude Sonnet 4.6/Opus 4.8 (1M context) <noreply@anthropic.com>

Author: christophe-papazian

manifests/python.yml

@@ -95,15 +95,36 @@ manifest:
         fastapi: v3.13.0.dev
   tests/appsec/api_security/test_endpoint_discovery.py::Test_Endpoint_Discovery::test_optional_type: irrelevant
   tests/appsec/api_security/test_endpoint_fallback.py: irrelevant (python weblogs always have http.route)
-  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_async_chat_completions_create: missing_feature
-  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_async_completions_create: missing_feature
-  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_async_responses_create: missing_feature
-  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_latest_chat_completions_create: missing_feature
-  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_latest_completions_create: missing_feature
-  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_latest_responses_create: missing_feature
-  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_legacy_chat_completions_create: missing_feature
-  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_legacy_completions_create: missing_feature
-  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_root_has_no_llm_tags: missing_feature
+  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_async_chat_completions_create:
+    - weblog_declaration:
+        "*": irrelevant (openai instrumentation is framework-independent, only tested on flask-poc)
+        flask-poc: v4.12.0rc1
+  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_async_completions_create:
+    - weblog_declaration:
+        "*": irrelevant (openai instrumentation is framework-independent, only tested on flask-poc)
+        flask-poc: v4.12.0rc1
+  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_async_responses_create:
+    - weblog_declaration:
+        "*": irrelevant (openai instrumentation is framework-independent, only tested on flask-poc)
+        flask-poc: v4.12.0rc1
+  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_latest_chat_completions_create:
+    - weblog_declaration:
+        "*": irrelevant (openai instrumentation is framework-independent, only tested on flask-poc)
+        flask-poc: v4.12.0rc1
+  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_latest_completions_create:
+    - weblog_declaration:
+        "*": irrelevant (openai instrumentation is framework-independent, only tested on flask-poc)
+        flask-poc: v4.12.0rc1
+  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_latest_responses_create:
+    - weblog_declaration:
+        "*": irrelevant (openai instrumentation is framework-independent, only tested on flask-poc)
+        flask-poc: v4.12.0rc1
+  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_legacy_chat_completions_create: irrelevant (legacy openai API not available in openai >= 1.0)
+  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_openai_legacy_completions_create: irrelevant (legacy openai API not available in openai >= 1.0)
+  tests/appsec/api_security/test_endpoints.py::Test_LLM_Endpoint::test_root_has_no_llm_tags:
+    - weblog_declaration:
+        "*": irrelevant (openai instrumentation is framework-independent, only tested on flask-poc)
+        flask-poc: v4.12.0rc1
   tests/appsec/api_security/test_schemas.py::Test_Scanners:
     - weblog_declaration:
         "*": v2.4.0

tests/appsec/api_security/test_endpoints.py

@@ -71,7 +71,7 @@ def setup_openai_async_completions_create(self):
     def test_openai_async_completions_create(self):
         assert_llm_span(self.request, self.MODEL)
 
-    def setup_root_no_llm(self):
+    def setup_root_has_no_llm_tags(self):
         # Baseline request to root endpoint should not produce LLM tags
         self.root_request = weblog.get("/")
 

utils/build/docker/python/docker-bake.hcl

@@ -39,13 +39,13 @@ target "django-poc" {
 target "flask-poc" {
   context    = "."
   dockerfile = "utils/build/docker/python/flask-poc.base.Dockerfile"
-  tags       = ["datadog/system-tests:flask-poc.base-v13"]
+  tags       = ["datadog/system-tests:flask-poc.base-v14"]
 }
 
 target "uwsgi-poc" {
   context    = "."
   dockerfile = "utils/build/docker/python/uwsgi-poc.base.Dockerfile"
-  tags       = ["datadog/system-tests:uwsgi-poc.base-v9"]
+  tags       = ["datadog/system-tests:uwsgi-poc.base-v10"]
 }
 
 target "tornado" {

utils/build/docker/python/fastapi/requirements-fastapi.txt

@@ -1,6 +1,9 @@
 PyYAML
-fastapi
-uvicorn
+fastapi==0.135.2
+starlette==1.3.1
+uvicorn==0.49.0
+anyio==4.13.0
+pydantic==2.13.4
 requests
 cryptography==42.0.8
 pycryptodome

utils/build/docker/python/flask-poc.Dockerfile

@@ -1,4 +1,4 @@
-FROM datadog/system-tests:flask-poc.base-v13
+FROM datadog/system-tests:flask-poc.base-v14
 
 WORKDIR /app
 

utils/build/docker/python/flask-poc.base.Dockerfile

@@ -21,5 +21,5 @@ RUN apt update && apt install -y pkg-config default-libmysqlclient-dev pkg-confi
 COPY utils/build/docker/python/flask/requirements-flask-poc.txt /tmp/flask-requirements.txt
 RUN pip install --upgrade pip && pip install -r /tmp/flask-requirements.txt
 
-# docker build --progress=plain -f utils/build/docker/python/flask-poc.base.Dockerfile -t datadog/system-tests:flask-poc.base-v12 .
-# docker push datadog/system-tests:flask-poc.base-v12
+# docker build --progress=plain -f utils/build/docker/python/flask-poc.base.Dockerfile -t datadog/system-tests:flask-poc.base-v14 .
+# docker push datadog/system-tests:flask-poc.base-v14

utils/build/docker/python/flask/app.py

@@ -58,6 +58,7 @@
 from iast import weak_hash_duplicates
 from iast import weak_hash_multiple
 from iast import weak_hash_secure_algorithm
+import openai
 import requests
 import stripe
 import opentelemetry.baggage
@@ -2252,6 +2253,36 @@ def stripe_webhook():
         return jsonify({"error": str(e)}), 403
 
 
+@app.route("/llm")
+async def llm():
+    model = request.args.get("model", "")
+    operation = request.args.get("operation", "")
+    if not model or not operation:
+        return jsonify({"error": "Missing or empty query parameters: model, operation"}), 400
+    try:
+        if operation == "openai-latest-responses.create":
+            openai.OpenAI(api_key="sk-fake").responses.create(model=model, input="Hello")
+        elif operation == "openai-latest-chat.completions.create":
+            openai.OpenAI(api_key="sk-fake").chat.completions.create(
+                model=model, messages=[{"role": "user", "content": "Hello"}]
+            )
+        elif operation == "openai-latest-completions.create":
+            openai.OpenAI(api_key="sk-fake").completions.create(model=model, prompt="Hello")
+        elif operation == "openai-async-responses.create":
+            await openai.AsyncOpenAI(api_key="sk-fake").responses.create(model=model, input="Hello")
+        elif operation == "openai-async-chat.completions.create":
+            await openai.AsyncOpenAI(api_key="sk-fake").chat.completions.create(
+                model=model, messages=[{"role": "user", "content": "Hello"}]
+            )
+        elif operation == "openai-async-completions.create":
+            await openai.AsyncOpenAI(api_key="sk-fake").completions.create(model=model, prompt="Hello")
+        else:
+            return jsonify({"error": f"unknown operation: {operation}"}), 400
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+    return jsonify({"model": model, "operation": operation})
+
+
 @app.route("/sca/vulnerable-call")
 def sca_requests_vulnerable_call():
     """Trigger a call to requests.sessions.Session.send (CVE-2024-35195 target)."""

utils/build/docker/python/flask/requirements-flask-poc.txt

@@ -23,3 +23,4 @@ urllib3==1.26.19
 openfeature-sdk==0.8.3
 loguru==0.7.3
 stripe==12.5.1
+openai==2.41.1

utils/build/docker/python/flask/requirements-uwsgi-poc.txt

@@ -21,3 +21,4 @@ PyMySQL==1.1.1
 openfeature-sdk==0.8.3
 loguru==0.7.3
 stripe==12.5.1
+openai==2.41.1

utils/build/docker/python/uds-flask.Dockerfile

@@ -1,4 +1,4 @@
-FROM datadog/system-tests:flask-poc.base-v13
+FROM datadog/system-tests:flask-poc.base-v14
 
 WORKDIR /app